Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backport CI fixes to stay green with latest libxml2 #145

Merged
merged 1 commit into from Nov 16, 2022
Merged

backport CI fixes to stay green with latest libxml2 #145

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
21 changes: 14 additions & 7 deletions test/sanitizer_test.rb
View file
Open in desktop
Expand Up @@ -54,7 +54,7 @@ def test_remove_xpaths_called_with_enumerable_xpaths

def test_strip_tags_with_quote
input = '<" <img src="trollface.gif" onload="alert(1)"> hi'
expected = libxml_2_9_14_recovery? ? %{&lt;" hi} : %{ hi}
expected = libxml_2_9_14_recovery_lt? ? %{&lt;" hi} : %{ hi}
assert_equal(expected, full_sanitize(input))
end

Expand All @@ -77,19 +77,19 @@ def test_strip_tags_multiline

def test_remove_unclosed_tags
input = "This is <-- not\n a comment here."
expected = libxml_2_9_14_recovery? ? %{This is &lt;-- not\n a comment here.} : %{This is }
expected = libxml_2_9_14_recovery_lt? ? %{This is &lt;-- not\n a comment here.} : %{This is }
assert_equal(expected, full_sanitize(input))
end

def test_strip_cdata
input = "This has a <![CDATA[<section>]]> here."
expected = libxml_2_9_14_recovery? ? %{This has a &lt;![CDATA[]]&gt; here.} : %{This has a ]]&gt; here.}
expected = libxml_2_9_14_recovery_lt_bang? ? %{This has a &lt;![CDATA[]]&gt; here.} : %{This has a ]]&gt; here.}
assert_equal(expected, full_sanitize(input))
end

def test_strip_unclosed_cdata
input = "This has an unclosed <![CDATA[<section>]] here..."
expected = libxml_2_9_14_recovery? ? %{This has an unclosed &lt;![CDATA[]] here...} : %{This has an unclosed ]] here...}
expected = libxml_2_9_14_recovery_lt_bang? ? %{This has an unclosed &lt;![CDATA[]] here...} : %{This has an unclosed ]] here...}
assert_equal(expected, full_sanitize(input))
end

Expand Down Expand Up @@ -458,13 +458,13 @@ def test_should_sanitize_img_vbscript

def test_should_sanitize_cdata_section
input = "<![CDATA[<span>section</span>]]>"
expected = libxml_2_9_14_recovery? ? %{&lt;![CDATA[<span>section</span>]]&gt;} : %{section]]&gt;}
expected = libxml_2_9_14_recovery_lt_bang? ? %{&lt;![CDATA[<span>section</span>]]&gt;} : %{section]]&gt;}
assert_sanitized(input, expected)
end

def test_should_sanitize_unterminated_cdata_section
input = "<![CDATA[<span>neverending..."
expected = libxml_2_9_14_recovery? ? %{&lt;![CDATA[<span>neverending...</span>} : %{neverending...}
expected = libxml_2_9_14_recovery_lt_bang? ? %{&lt;![CDATA[<span>neverending...</span>} : %{neverending...}
assert_sanitized(input, expected)
end

Expand Down Expand Up @@ -657,10 +657,17 @@ def convert_to_css_hex(string, escape_parens=false)
end.join
end

def libxml_2_9_14_recovery?
def libxml_2_9_14_recovery_lt?
# changed in 2.9.14, see https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.5
Nokogiri.method(:uses_libxml?).arity == -1 && Nokogiri.uses_libxml?(">= 2.9.14")
end

def libxml_2_9_14_recovery_lt_bang?
# changed in 2.9.14, see https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.5
# then reverted in 2.10.0, see https://gitlab.gnome.org/GNOME/libxml2/-/issues/380
Nokogiri.method(:uses_libxml?).arity == -1 && Nokogiri.uses_libxml?("= 2.9.14")
end

def html5_mode?
::Loofah.respond_to?(:html5_mode?) && ::Loofah.html5_mode?
end
Expand Down